CVE-1999-1422: High severity Slackware Slackware Linux vulnerability
The default configuration of Slackware 3.4, and possibly other versions, includes . (dot, the current directory) in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the '.' entry from the PATH environment variable so the current directory is not searched. Update the system and user shell startup files (so they no longer add '.') and ensure affected user sessions are reloaded or users re-login to pick up the change.
Slackware Linux PATH environment variable = remove '.' (the current directory) from PATH
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1422?
CVE-1999-1422 is considered a local vulnerability that can lead to the execution of Trojan horse programs.
How do I fix CVE-1999-1422?
To fix CVE-1999-1422, remove the current directory (.) from the PATH environment variable configuration.
Who is affected by CVE-1999-1422?
CVE-1999-1422 affects users of Slackware 3.4 and possibly other versions with default configurations.
What are the potential risks associated with CVE-1999-1422?
The potential risks include local users executing malicious programs, which could compromise system security.
Is CVE-1999-1422 a known issue in other Linux distributions?
CVE-1999-1422 primarily affects Slackware, but similar path vulnerabilities could be present in other distributions with default configurations.